The Virus problem on this site is getting out of control

[scottm]

I came close to wiping my windows laptop after getting a virus here, extreme measures just recovered it barely. I logged on to T4R at work with an IT guy watching, he was impresses at how nasty the virus was, we managed to block it. I started a thread about it, not much interest, so now I rarely come here. Borrowed my son's iPad tonight, thought I'd pop in, but now I'm pretty much out of the T4R habit.

 

[tony_4r]

Yeap, I got one via a Java update from here. I still don't know if my PC is completely clean from it. It shows as a search engine redirect, basically sending you to sites you are not intending to go after performing a Google search.

 

[eli_lilly]

Yeap, I got one via a Java update from here. I still don't know if my PC is completely clean from it. It shows as a search engine redirect, basically sending you to sites you are not intending to go after performing a Google search.

Download combofix and run it, it will fix it. There's no options or anything, you just download it, run it, wait a gazillion years, and it reboots and the mess is gone.

-E

 

[jdkilroy]

Mac, Sea Monkey (Mozilla) and Sophos = no problems.

That said, navigating this site has commonly resulted in redirects that opened new tabs; these were often sites asking you to take a survey.

 

[jrm]

Heres another one

got this one this morning...

http://www.usijkliausa.in/ftg.js?toyo

 

[nevada]

http://www.toyota-4runner.org/4th-gen-t4rs/122006-virus-problem-site-getting-out-control.html

maybe these can be merged?
theres atleast one other recent theread out there aswell.

 

[jrm]

"disguises self as a adobe/java update"

the virus is called Sirefef. to this day I have yet to find an anti-virus that will block it. agv, essentials, norton have been unsuccessful in preventing this virus. it disguises itself as an adobe or java update. one you get it, its very hard to get rid of. even software like malwarebytes removes only portions of it. then it eventually comes back. check the Eset antivirus site for the tools you need to remove.

once you go to install the fake update, will the anti virus catch it or is it too late.:satan:

 

[eli_lilly]

once you go to install the fake update, will the anti virus catch it or is it too late.:satan:

When you see the prompt for the fake update you're already infected. What happens is a bug in Java or Flash is used to siliently install the rootkit. Once the rootkit is up and running, it launches its first payload, which is the fake update thing. It will keep launching that, redirecting your browser, stealing your usernames and passwords, and other fantastic stuff until the rootkit is removed. When I caught it, the antivirus software was catching and preventing the payload launches... but did not recognize the rootkit or see that it was installed and running. Neither did McAfee's rootkit removal util, neither did Kapersky's TDSSKiller. Combofix did find and remove it.

-E

 

[Sungod]

the virus is called Sirefef. to this day I have yet to find an anti-virus that will block it. agv, essentials, norton have been unsuccessful in preventing this virus. it disguises itself as an adobe or java update. one you get it, its very hard to get rid of. even software like malwarebytes removes only portions of it. then it eventually comes back. check the Eset antivirus site for the tools you need to remove.

Mine is trying to run the adobe update. How do I get rid of it?

 

[run4estrunner]

Mine is trying to run the adobe update. How do I get rid of it?

You can start by laying off the gay porn sungod :hello::boink:

 

[scottm]

Mine is trying to run the adobe update. How do I get rid of it?

If your Restore function isn't already disabled try that. Mine was already disabled by the time I tried it. Like I said, this is a nasty bug.

 

[eli_lilly]

Mine is trying to run the adobe update. How do I get rid of it?

Download and run combofix.

-E

 

[CXS]

If the Admin let's it ride with all these reported problems its simply a matter of time before it's totally infected or malware is injected and it becomes inaccessible. I know that as a fact because I spent yesterday fixing my vBulletin site that was infected.

As a Mac user I was unaware but starting yesterday morning my users started sending me PM's, e-mails and phone calls telling me we had been hacked. It sounded pretty much like the messages above but by noon it was inaccessible. I hope it doesn't happen here.

 

[jimithing]

If the Admin let's it ride with all these reported problems its simply a matter of time before it's totally infected or malware is injected and it becomes inaccessible. I know that as a fact because I spent yesterday fixing my vBulletin site that was infected.

As a Mac user I was unaware but starting yesterday morning my users started sending me PM's, e-mails and phone calls telling me we had been hacked. It sounded pretty much like the messages above but by noon it was inaccessible. I hope it doesn't happen here.

Would be nice if they would at least comment and say what's going on. I PM'ed the Admin and one of the moderators a link to this thread a couple days ago and haven't gotten a response. And they obviously haven't posted in here either. Kinda sucks.

 

[Sungod]

Download and run combofix.

-E

I looked at combofix. It looks pretty aggressive. How scary is it to use?

 

[admin]

Just catching up on this thread. Looking into it. I don't run into any issues, and I visit the site from variety of computers/OSes.

Investigating ...

Update 1:

I haven't found anything suspicious. I also scanned the site using a 3rd party tool, which found no issues either. Here are the results of the scan:
Sucuri SiteCheck - Free Website Malware Scanner

Update 2:
Another service reported the site as safe. See attached screensnap.

Update 3:
AVG reported this site as safe as well.

Update 4:
Norton is also reporting the site as safe:


I'll keep digging.

 

[Sungod]

As soon as I opened this site today I got a pop up message regarding another block from malwarebytes. I'll be happy to send you my logs from malware and mcafee.

 

[admin]

Yes, definitely interested in the logs, as it may be related to a particular thread or post. You can email it to me directly to info<at>toyota-4runner.org

Also, what OS and browser+version are you using?

Thanks,
admin.

 

[eli_lilly]

I looked at combofix. It looks pretty aggressive. How scary is it to use?

I thought the same thing, but it's just run it and let it go. Takes maybe 30 mins. After I saw them use it on my PC here at work, I downloaded it and ran it on two desktops at home and two laptops. It found and removed something on my main desktop, even though I run MS Security Essentials.

-E

 

[admin]

Gents, for those that are getting virus alerts, do they happen across the site or on a specific thread? If specific thread, can you post the thread url here?

Thanks,
admin.